Hi, I have an exec script that I want to run when authenticating a user. The script takes in the username. I want to run the script both for PEAP authentications and PAP authentications. The problem I have is that if I put the exec in the inner-tunnel post-auth section it will work fine for the PEAP transactions, as it has the username. However if I also want to authenticate PAP, then I need to put it in the default post-auth. So it will work fine for PAP transactions as it has the username. However if its in the default, the script will be run for PEAP transactions with the wrong username (anonymous) and then will fail. Is there some way I can tell the server not to run things in the default post-auth, if the request has been through the inner-tunnel? I'm thinking putting something like the following in the default post-auth section if (!proxy-reply:Packet-Type == "Access-Accept") { radius-user-auth } However this always evaluates as true, even though I can see the inner-tunnel authenticating successfully. thanks, paul